EU DORA · Testing
DORA testing, demystified
The EU Digital Operational Resilience Act makes testing a legal duty for financial entities. Understand what you must test, how often, and where advanced threat-led testing kicks in.
- Based on Regulation (EU) 2022/2554
- Applies since Jan 2025
- Primary sources linked
What is DORA
Testing your resilience is no longer optional
DORA is an EU regulation that makes digital operational resilience – including regular testing – a binding requirement for the financial sector.
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, has applied across the EU since 17 January 2025. It sets uniform requirements for how financial entities manage and prove their resilience to ICT disruptions.
One of its five pillars is digital operational resilience testing. Except for microenterprises, entities must run a documented, risk-based testing programme and test the ICT systems supporting critical or important functions at least once a year, using independent, qualified testers.
A subset goes further: financial entities that competent authorities identify under Article 26(8) – commonly called “significant entities”, though DORA does not use that term – must undergo advanced threat-led penetration testing (TLPT) at least every three years, modelled on real-world attacks. This guide focuses on the testing pillar – who must do what, and how often.
The testing regime
What DORA actually requires you to test
Four essentials that define the resilience-testing pillar.
- PROGRAMME
A testing programme
Not ad-hoc checks – DORA requires a documented, risk-based testing programme covering the ICT systems that support your important and critical functions.
- BASELINE
Baseline tests, yearly
For entities other than microenterprises, Article 24 requires appropriate annual testing of systems supporting critical or important functions. The test mix follows risk; Article 25(3) addresses microenterprises.
- TLPT
Threat-led pen testing
Financial entities identified by their competent authority must perform advanced threat-led penetration testing (TLPT) at least every three years, modelled on the TIBER-EU framework and real threat intelligence.
- INDEPENDENT
Independent testers
Testing must be carried out by qualified, independent parties. For TLPT, testers must meet strict competence and independence criteria set out in the regulation.
What to test
The testing types, and how often
DORA expects a layered programme. These are the main test types and their cadence.
- Baseline · yearly
Vulnerability assessments & scans
Regular automated and manual assessment of weaknesses across ICT assets supporting important functions.
Under DORA: Part of the required baseline testing programme.
- Risk-based mix
Penetration testing
Hands-on testing of critical systems to find exploitable weaknesses before an attacker does.
Under DORA: Select scope and frequency from risk; not a blanket yearly pentest duty.
- Programme
Scenario-based & resilience tests
Exercises that test detection, response, business continuity and recovery – not just prevention.
Under DORA: Evidence that ICT can withstand and recover from disruption.
- Advanced · 3 years
Threat-led penetration testing (TLPT)
Intelligence-led, red-team-style testing against live systems, mandatory for the entities authorities identify.
Under DORA: Required at least every three years for in-scope entities.
Applicability check
Does DORA testing apply to you – and what’s required?
Answer a couple of questions for a plain-English indication of your testing obligations. This is guidance, not legal advice.
Interactive mode is not available. You can read the full reference content below. No answers are assessed and no result is calculated.
Is your organisation an EU financial entity or an ICT provider serving one?
Have you confirmed your legal classification?
Small size alone does not establish an exemption. Check Article 2 exclusions, the Article 3 microenterprise definition and Article 16(1).
Has your competent authority identified you for TLPT?
Self-description as significant or systemically important does not establish the obligation. But Article 2(2) of the TLPT technical standards lists classes the authority must require to test unless its own assessment says otherwise.
The testing programme applies to you in full
Article 16(1) disapplies Articles 5 to 15 only – the ICT risk-management chapter – and replaces them with the simplified framework in its second subparagraph. Chapter IV is untouched. Article 24 excludes microenterprises and no one else, so you owe the same documented programme, the same risk-based mix from Article 25, the same independent testers, and tests at least once a year on all ICT systems and applications supporting critical or important functions. The one testing relief is TLPT: Article 26(1) excludes Article 16(1) entities from it.
Plan for TLPT before the letter arrives
Article 2(2) of Commission Delegated Regulation (EU) 2025/1190 requires TLPT authorities to put your class in scope unless their Article 2(1) assessment finds that your impact, the financial stability concerns or your ICT risk profile do not justify a test. Every CSD and every CCP is on that list with no threshold at all. It is a rebuttable presumption, not a self-declaration – the authority still decides – but planning on the annual programme alone is the wrong bet. Budget the three-year cycle and the statutory clocks.
Confirm the applicable legal category
Check the financial-entity categories and exclusions in Article 2 with your competent authority. An uncertain answer does not establish an exemption. ICT providers can face contractual duties and, if designated critical, direct oversight.
Risk-based testing under Article 25(3)
Article 24 excludes microenterprises from its full testing-programme obligation. Article 25(3) still requires risk-based testing that balances resources against risk and criticality. This is not an exemption from all testing, and microenterprises are excluded from mandatory TLPT.
A full annual testing programme
You must maintain a documented testing programme and test ICT systems supporting critical or important functions at least once a year – using an appropriate risk-based mix from Article 25, carried out by independent testers. The law does not require every listed test type on every system each year.
Full programme + TLPT every 3 years
On top of the annual programme, entities identified by their competent authority must undergo advanced threat-led penetration testing (TLPT) at least every three years – modelled on the TIBER-EU framework, using real threat intelligence against live production systems. Testers must meet strict independence and competence criteria.
You’ll be drawn into your clients’ testing
ICT third-party providers to financial entities face contractual resilience obligations and are expected to support clients’ testing. Providers designated as critical fall under direct EU oversight. Being demonstrably test-ready is increasingly a commercial necessity.
Is your organisation an EU financial entity or an ICT provider serving one?
Have you confirmed your legal classification?
Small size alone does not establish an exemption. Check Article 2 exclusions, the Article 3 microenterprise definition and Article 16(1).
Has your competent authority identified you for TLPT?
Self-description as significant or systemically important does not establish the obligation. But Article 2(2) of the TLPT technical standards lists classes the authority must require to test unless its own assessment says otherwise.
The testing programme applies to you in full
Article 16(1) disapplies Articles 5 to 15 only – the ICT risk-management chapter – and replaces them with the simplified framework in its second subparagraph. Chapter IV is untouched. Article 24 excludes microenterprises and no one else, so you owe the same documented programme, the same risk-based mix from Article 25, the same independent testers, and tests at least once a year on all ICT systems and applications supporting critical or important functions. The one testing relief is TLPT: Article 26(1) excludes Article 16(1) entities from it.
Plan your DORA testingPlan for TLPT before the letter arrives
Article 2(2) of Commission Delegated Regulation (EU) 2025/1190 requires TLPT authorities to put your class in scope unless their Article 2(1) assessment finds that your impact, the financial stability concerns or your ICT risk profile do not justify a test. Every CSD and every CCP is on that list with no threshold at all. It is a rebuttable presumption, not a self-declaration – the authority still decides – but planning on the annual programme alone is the wrong bet. Budget the three-year cycle and the statutory clocks.
Discuss TLPTConfirm the applicable legal category
Check the financial-entity categories and exclusions in Article 2 with your competent authority. An uncertain answer does not establish an exemption. ICT providers can face contractual duties and, if designated critical, direct oversight.
Check your scopeRisk-based testing under Article 25(3)
Article 24 excludes microenterprises from its full testing-programme obligation. Article 25(3) still requires risk-based testing that balances resources against risk and criticality. This is not an exemption from all testing, and microenterprises are excluded from mandatory TLPT.
Plan your DORA testingA full annual testing programme
You must maintain a documented testing programme and test ICT systems supporting critical or important functions at least once a year – using an appropriate risk-based mix from Article 25, carried out by independent testers. The law does not require every listed test type on every system each year.
Plan your DORA testingFull programme + TLPT every 3 years
On top of the annual programme, entities identified by their competent authority must undergo advanced threat-led penetration testing (TLPT) at least every three years – modelled on the TIBER-EU framework, using real threat intelligence against live production systems. Testers must meet strict independence and competence criteria.
Discuss TLPTYou’ll be drawn into your clients’ testing
ICT third-party providers to financial entities face contractual resilience obligations and are expected to support clients’ testing. Providers designated as critical fall under direct EU oversight. Being demonstrably test-ready is increasingly a commercial necessity.
Get test-readyIndicative only – classification and exact obligations depend on your supervisor’s assessment and the applicable regulatory technical standards. Confirm your status with a qualified adviser.
Plan the testing your result calls for
Whether the flow pointed you to a basic testing programme or to TLPT, OffSeq can scope the tests, map them to Articles 24–27 and run them. Your answers in the flow are not attached to this request.
Thank you – your request has arrived.
We will reply to the email address you gave.
Sending failed. Try again or email support@offseq.com.
The facts
DORA at a glance
A regulation in force now, with real scope and real testing duties.
Each figure links to its primary source. Scope estimates are approximate; confirm your own status with a qualified adviser.
For security & compliance teams
Turn the testing pillar into a working programme
DORA doesn’t just ask whether you test – it asks whether you can evidence a documented, independent, risk-based programme.
Financial entities, other than microenterprises, shall … establish, maintain and review a sound and comprehensive digital operational resilience testing programme … [and] shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions.
-
Map critical functions first
Scope the ICT systems that support your important and critical functions – that’s what the testing programme must cover.
-
Layer the test types
Combine vulnerability assessments, penetration testing and scenario-based tests into a coherent annual programme, not one-off checks.
-
Use independent testers
DORA expects testing by qualified, independent parties – and TLPT has strict criteria for who may test.
-
Evidence everything
Document findings, remediation and retesting. Supervisors want proof the programme works, not just that a test happened.
Guides
Go deeper
Plain-English guides to DORA’s testing requirements and how to meet them.
-
DORA testing requirements: what you must test
DORA makes resilience testing a legal duty. Here’s the programme it requires, the test types, the cadence, and who must do the testing.
Read guide -
DORA TLPT explained: threat-led penetration testing
DORA mandates advanced threat-led penetration testing for the entities authorities identify. Here’s what TLPT is, who must do it, and how it works.
Read guide -
DORA testing checklist: from scope to evidence
A practical checklist to support a DORA-aligned resilience-testing programme – from scoping critical functions to remediation.
Read guide
Frequently asked questions
Short, clear answers
What is DORA testing?
“DORA testing” is the digital operational resilience testing pillar of Regulation (EU) 2022/2554 – Chapter IV, Articles 24 to 27. It obliges financial entities other than microenterprises to run a documented, risk-based testing programme, drawing on the twelve test types in Article 25(1), with independent testers and an at-least-yearly test of every ICT system supporting a critical or important function. Entities the authorities identify add threat-led penetration testing on top.
What is DORA?
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025. It sets ICT risk-management, incident-reporting, resilience-testing and third-party-risk requirements for financial entities within its scope.
What testing does DORA require?
For entities other than microenterprises, Article 24 requires a documented, risk-based testing programme and appropriate annual testing of systems supporting critical or important functions. Microenterprises follow Article 25(3). Test types depend on risk; selected entities also perform TLPT.
Who is in scope of DORA?
A broad range of EU financial entities – banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and more – plus their critical ICT third-party providers.
What is TLPT under DORA?
Threat-led penetration testing: advanced, intelligence-led red-team testing of live systems, required of the entities competent authorities identify, at least every three years, and modelled on the TIBER-EU framework. Article 2(2) of Commission Delegated Regulation (EU) 2025/1190 sets out the classes an authority must require to test unless its assessment says otherwise – all CSDs and CCPs among them.
How often must we test under DORA?
Article 24 requires appropriate testing at least yearly on systems supporting critical or important functions; microenterprises follow Article 25(3) instead. Entities identified by their competent authority must additionally undergo TLPT at least every three years.
Can we use our own staff to test?
DORA requires testing by independent, qualified parties, and allows internal testers only under conditions (with safeguards for independence). TLPT in particular has strict criteria on tester competence and independence, so plan the sourcing early.
What happens if we don’t comply?
DORA is directly applicable and enforced by national competent authorities, which can require remediation and impose penalties. Beyond fines, an untested resilience posture is a real operational and reputational risk.
Tell us where you stand
Say what testing you already run and what your regulator expects. OffSeq will reply with a suggested next step and the likely scope of work.
Thank you – your request has arrived.
We will reply to the email address you gave.
Sending failed. Try again or email support@offseq.com.